deploy.yaml

name: Build and Deploy

on:
  workflow_dispatch:
  push:
    branches: [ main ]

permissions: {}

jobs:
  build:
    runs-on: ubuntu-latest

    # These permissions are needed to interact with GitHub's OIDC Token endpoint.
    permissions:
      id-token: write
      contents: read

    steps:
      - uses: GitHubSecurityLab/actions-permissions/monitor@v1

      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Set up Ruby
        uses: ruby/setup-ruby@b90be12699fdfcbee4440c2bba85f6f460446bb0 # v1.279.0
        with:
          bundler-cache: true

      - name: Install dependencies
        run: bundle install

      - name: Build site
        run: bundle exec jekyll build

      - name: Tailscale authenticate
        uses: tailscale/github-action@53acf823325fe9ca47f4cdaa951f90b4b0de5bb9 # v4.1.1
        with:
          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
          tags: tag:ci
          ping: ${{ secrets.K8S_CONTROL_HOST }}

      # Tailscale handles authentication
      - name: Deploy site files
        env:
          K8S_CONTROL_USER: ${{ secrets.K8S_CONTROL_USER }}
          K8S_CONTROL_HOST: ${{ secrets.K8S_CONTROL_HOST }}
        run: |
          rsync -avz --delete \
            -e "ssh -o StrictHostKeyChecking=accept-new" \
            _site/ \
            "${K8S_CONTROL_USER}@${K8S_CONTROL_HOST}:/var/www/sites/knowledge-base/"

      # Tailscale handles authentication
      - name: Restart website
        env:
          K8S_CONTROL_USER: ${{ secrets.K8S_CONTROL_USER }}
          K8S_CONTROL_HOST: ${{ secrets.K8S_CONTROL_HOST }}
        run: |
          ssh "${K8S_CONTROL_USER}@${K8S_CONTROL_HOST}" "
            k3s kubectl -n kb-prod rollout restart deploy/knowledge-base
            k3s kubectl -n kb-prod wait --for=condition=available deploy/knowledge-base --timeout=60s
          "